The security side of Datadog — with no per-host metering surprise.
Datadog Cloud SIEM, Cloud Security Management, and Workload Security are strong individual products with notoriously hard-to-predict bills. Tessarac replaces that slice (we don't try to replace APM) with a tighter platform, hardware-bound agent identity, and predictable per-protected-system pricing.
Scope clarity
We replace the security slice. We don't try to replace APM.
Datadog has APM, RUM, Logs, Synthetics, Metrics, plus the security suite (Cloud SIEM, CSM, Workload Security). Tessarac is honestly a security platform — we don't try to replace APM or product-analytics. If you keep Datadog for those, the security-side bill comes off.
- Datadog Cloud SIEM → Tessarac AI-Empowered 24/7 SOC (always-on triage with attached context on every alert)
- Datadog Cloud Security Management → Tessarac Cloud Security Posture (CSPM)
- Datadog Workload Security (CWS) → Tessarac Sentinel (EDR with hardware-bound TPM identity)
- Datadog Sensitive Data Scanner → Tessarac Secrets + audit-grep
- + Tessarac Identity, Privileged Access, Secrets vault, API-key plane — none of which Datadog sells
Side-by-side: Tessarac vs. Datadog Security
Honest assessment as of May 2026. Where Datadog Security ships an equivalent capability we say so; where they don't we say so. Notes carry the source.
Detection + response
| Feature | Tessarac | Datadog Security |
|---|---|---|
SIEM with cloud + agent telemetry | Yes | Yes |
AI-attached context on every alert Datadog has Bits AI; Tessarac attaches context to every alert and deeply investigates every escalation as a default behavior, not an add-on. | Yes | Partial |
Continuous learning from analyst dispositions | Yes | Partial |
Cordon recommendations with full evidence chain | Yes | Partial |
Hash-only IOC lookups (no file content uploaded) | Yes | Partial |
EDR + workload security
| Feature | Tessarac | Datadog Security |
|---|---|---|
Kernel telemetry (eBPF / ESF / ETW) | Yes | Yes |
Multi-engine antivirus | Yes | Partial |
Hardware-bound (TPM / Secure Enclave) identity | Yes | No |
< 100MB RAM, < 1% CPU steady-state | Yes | Partial |
5-tier graduated cordon | Yes | Partial |
Cloud security posture
| Feature | Tessarac | Datadog Security |
|---|---|---|
Agentless CSPM scanning | Yes | Yes |
Native ingest from Security Hub / Defender / SCC | Yes | Yes |
IPv6 readiness rules (M-21-07) | Yes | Partial |
What Datadog doesn't sell
| Feature | Tessarac | Datadog Security |
|---|---|---|
Workforce + Customer SSO (IdP) | Yes | No |
Privileged access (SSH / RDP / DB brokering) | Yes | No |
Secrets vault + internal CA | Yes | No |
API-key management plane for products you ship | Yes | No |
Pricing + deployment
| Feature | Tessarac | Datadog Security |
|---|---|---|
Predictable per-protected-system pricing Datadog meters per host + per ingested GB + per indexed event; bills surprise frequently. | Yes | No |
Customer-visible per-tenant audit | Yes | Partial |
Audit export to BYO destination | Yes | Partial |
Air-gapped install | Yes | No |
Self-host (your infrastructure) | Yes | No |
Open source (community edition) | Yes | No |
FedRAMP High path | Yes | Yes |
DoD IL5 path | Yes | Partial |
One bill for everything above | Yes | No |
Cost predictability
Per-protected-system pricing — the bill is what you said it would be.
Datadog's metering is per-host + per-ingested-GB + per-indexed-event + per-RUM-session + per-metric-host. Composing those for a security workload routinely produces a bill 2-3x what was modeled. Tessarac's per-protected-system pricing absorbs all of that into one line; the bill is what the calculator said it would be.
- Per-protected-system pricing — same number on the calculator and the bill
- Bounded per-tenant inference spend; configurable monthly ceiling on escalation cost
- Open-core licensing — pilot the platform on the Community edition before any commercial conversation
- Per-tenant inference-cost meter visible in the admin console — bill it back to security if you want to
Replace the security slice. Keep what you keep.
Tessarac replaces Datadog's security suite with one platform and a predictable bill. Your APM and product analytics stay where they are.